lsof - Unix, Linux Command


Advertisements


NAME

lsof: list open files.

SYNOPSIS

  • lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g[s] ] [ -i [i] ] [ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ][ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]
  • DESCRIPTION

    An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path. Instead of a formatted display, lsof will produce output that can be parsed by other programs. In addition to producing a single output list, lsof will run in repeat mode. In repeat mode it will produce output, delay, then repeat the output operation until stopped with an interrupt or quit signal.

    Options

    Tag Description
    -? -h These two equivalent options select a usage (help) output list. Lsof displays a shortened form of this output when it detects an error in the options supplied to it, after it has displayed messages explaining each error. .
    -a This option causes list selection options to be ANDed, as described above.
    -A A This option is available on systems configured for AFS whose AFS kernel code is implemented via dynamic modules. It allows the lsof user to specify A as an alternate name list file where the kernel addresses of the dynamic modules might be found.
    -b This option causes lsof to avoid kernel functions that might block - lstat, readlink, and stat.
    -cc This option selects the listing of files for processes executing the command that begins with the characters of c. Multiple commands may be specified, using multiple -c options. They are joined in a single ORed set before participating in AND option selection.
    If c begins with a '^', then the following characters specify a command name whose processes are to be ignored (excluded.)
    +c w This option defines the maximum number of initial characters of the name, supplied by the UNIX dialect, of the UNIX command associated with a process to be printed in the COMMAND column.
    -C This option disables the ratio of the components of path names of the kernel name cache. See the section CACHE OF NAMES OF CORE for more information.
    d + s This option tells lsof to search for all open instances of directory s and the files and directories it contains the first level. This option does NOT descend into the root directory tree s , and does not follow symbolic links within it. Option + D D can be used to request a search on the depth of the directory tree with the directory D to root.
    -d s This option selects the listing of files whose descriptors are present in all s comma-separated - eg, "1.3" or "6, cwd, 2". (There should not be any spaces in the set.)
    -D+D This option tells lsof to search for all open instances of directory D and all files and directories it contains to its maximum depth. Symbolic links within the directory D are ignored, ie d. not followed.
    -D D This option forces the use of the file cache devices by lsof. Using this option may be prohibited.
    + | -f [CfgGn] f clarifies itself how path name arguments are to be interpreted. When this option is followed by c , f , g , G or n in any combination, it specifies that the kernel file structure information of the list must be authorized ( "+") or prohibited ( "-" ).
    -F f This option specifies a list of characters, f , that selects the fields to go out for a treatment with another program, and the character that terminates each output field. Each field is specified to produce a single character in f .
    -g [s] This option selects the listing of files for the processes whose number IDentification process group (group ID) is present in all s comma-separated - eg, "123" or "123,456." (There should not be any space throughout.)
    -i [i] This option selects the listing of files whose Internet address matches the address specified with i . If no address is specified, this option selects the listing of all files and Internet networks x.25 (HP-UX).
    -k k This option specifies a kernel name list file, k , instead of / vmunix, / mach, etc. This option is not available on AIX on IBM RISC / System 6000.
    -l This option prevents the user ID conversion to login. It is also used when the research username is not working properly or too slowly.
    + | -L [L] This option allows ( "+") or off ( "-") the listing of file link counts when available - eg, they are not available for sockets, or most FIFOs (queues pending) and pipes. When + L is specified without a number after every link counts will be listed. When -L is specified (the default), no link counts will be listed. When + L is followed by a number, only files with a counter value of links below that number will be listed.
    -m m This option specifies a kernel memory file, c instead of / dev / kmem or / dev / mem - eg a memory dump file after a crash.
    + | -M Authorize ( + ) or disables ( - ) the registration reporting portmapper (portmapper) for local TCP and UDP ports. The default reporting mode is determined when building lsof with the #define HASPMAPENABLED the header file machine.h dialect used; lsof is distributed with this definition of disabled macro, and thus the ratio of the port manager is disabled by default and must be required with + M .
    -not This option prevents the conversion of network numbers (decimal places) to host names for network files. Prohibit the conversion can accelerate lsof. It is also useful when looking for host names is not working properly.
    -NOT This option selects the listing of NFS files.
    -o This option tells lsof to always display the position (offset) in the file. It causes replacement as the output column SIZE / OFF (size / pos) by OFFSET. Note: On some UNIX dialects lsof can not obtain accurate or consistent information on the position in the file from its kernel data sources, sometimes only for certain types of files read (eg, socket files.) FAQ lsof (section FAQ gives its location.)
    o o This option sets the number of decimal digits ( o ) to display after "0t" for a position in a file before it passes to the form "0x ...". A value of zero (unlimited) for o tells lsof to use the form "0t" for all position outputs.
    -O This option tells lsof to avoid the strategy it uses to avoid being blocked by some kernel operations - ie d.
    -p s This option selects the listing of files for the processes whose ID numbers are present in all comma-separated s - eg, "123" or "123,456." Multiple process ID numbers are combined in one set with the binary OR before participating in a selection and binary options.
    -P This option prevents the conversion of port numbers to port names for network files. Disable conversion can accelerate a little lsof. It is also useful when looking for host names is not working properly.
    + | -r [t] This option puts lsof in repeat mode. lsof list open files then selected by other options, waits t seconds (fifteen default), then repeats the listing, waiting list and repeatedly until stopped by a condition defined by the prefix of the option.
    -R This option tells lsof to list the ID numbers of parent processes (Parent Process IDentification number, PPID) in the PPID column.
    -s This option tells lsof to always display the file size. This causes replacement as the output column SIZE / OFF SIZE. If the file does not have size, nothing is displayed.
    -S [T] This option specifies an optional timeout value for kernel functions - lstat readlink and stat - that might otherwise lead to a deadlock. The minimum for t is two; the default, fifteen; when no value is specified, the default is used.
    -T [T] This option controls the information report TCP / TPI, also reported by netstat (1), following the network addresses. In normal output the information appears in parentheses, each item except state identified by a keyword.
    -t This option specifies that lsof should produce terse output with process identifiers only and no header - eg, so that the output can be piped to kill. This option selects the -w.
    -u s This option selects the listing of files for users whose name or user ID is present in all comma-separated s - eg "abe", or "548, root.Multiple logins and user ID numbers are combined in one set with the binary OR before participating in a selection and binary options
    -U This option selects the listing of UNIX domain socket files.
    -v This option selects the listing of a version of information lsof including: revision number; construction date ; identity of the builder and construction location; name of the compiler used; compiler version number if available; compiler options and charger used to build the binary lsof ; and information on the system, typically leaving the option -a of uname.
    -V This option directs lsof to indicate the items it was asked to list and has not found - command names, file names, addresses or Internet files, login names, NFS files, PIDs, PGIDs and UIDs. When other options are associated with a binary AND with options, lsof may not report that it failed to find a search item when an associated option with AND prevents the listing of the open file localized search item.
    +|-W Authorize ( + ) or disables ( - ) the suppression of warning messages. The builder lsof can choose to disable or enable the default warning messages. The default warning message status is shown in the output of the option -h or -? . Disable warning messages when they already are or activate them when they are already enabled is acceptable. The option -t selects the option -w.
    -X It is a dialect-specific option.

    EXAMPLES

    Example-1:

    To list all Open Files:

    # lsof

    output:

    # lsof
    COMMAND    PID  TID            USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
    init         1                 root  cwd       DIR              252,0     4096          2 /
    init         1                 root  rtd       DIR              252,0     4096          2 /
    init         1                 root  txt       REG              252,0   265848         54 /sbin/init
    init         1                 root  mem       REG              252,0    47712     393444 /lib/x86_64-linux-gnu/libnss_files-2.19.so
    init         1                 root  mem       REG              252,0    47760     393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.so
    init         1                 root  mem       REG              252,0    97296     393438 /lib/x86_64-linux-gnu/libnsl-2.19.so
    init         1                 root  mem       REG              252,0    39824     393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.so
    init         1                 root  mem       REG              252,0    14664     393401 /lib/x86_64-linux-gnu/libdl-2.19.so
    init         1                 root  mem       REG              252,0   252032     393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1
    init         1                 root  mem       REG              252,0   141574     393475 /lib/x86_64-linux-gnu/libpthread-2.19.so
    init         1                 root  mem       REG              252,0  1840928     393385 /lib/x86_64-linux-gnu/libc-2.19.so
    init         1                 root  mem       REG              252,0    31792     393481 /lib/x86_64-linux-gnu/librt-2.19.so
    init         1                 root  mem       REG              252,0    43464     393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0
    init         1                 root  mem       REG              252,0   134296     393483 /lib/x86_64-linux-gnu/libselinux.so.1
    ...

    kworker/0    5                 root  cwd       DIR              252,0     4096          2 /
    kworker/0    5                 root  rtd       DIR              252,0     4096          2 /
    kworker/0    5                 root  txt   unknown                                        /proc/5/exe

    more...

    Example-2:

    To list User Specific Opened Files:

    # lsof -u ubuntu

    output:

    COMMAND  PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAME
    sshd    1427 ubuntu  cwd    DIR              252,0     4096      2 /
    sshd    1427 ubuntu  rtd    DIR              252,0     4096      2 /
    sshd    1427 ubuntu  txt    REG              252,0   766784 800542 /usr/sbin/sshd
    sshd    1427 ubuntu  mem    REG              252,0    14464 393517 /lib/x86_64-linux-gnu/security/pam_env.so
    sshd    1427 ubuntu  mem    REG              252,0    22896 393526 /lib/x86_64-linux-gnu/security/pam_limits.so
    sshd    1427 ubuntu  mem    REG              252,0    10320 393530 /lib/x86_64-linux-gnu/security/pam_mail.so
    sshd    1427 ubuntu  mem    REG              252,0    10344 393532 /lib/x86_64-linux-gnu/security/pam_motd.so
    sshd    1427 ubuntu  mem    REG              252,0    14592 393455 /lib/x86_64-linux-gnu/libpam_misc.so.0.82.0
    sshd    1427 ubuntu  mem    REG              252,0    38920 393435 /lib/x86_64-linux-gnu/libnih-dbus.so.1.0.0
    sshd    1427 ubuntu  mem    REG              252,0    96280 393437 /lib/x86_64-linux-gnu/libnih.so.1.0.0
    sshd    1427 ubuntu  mem    REG              252,0   108480 393390 /lib/x86_64-linux-gnu/libcgmanager.so.0.0.0
    sshd    1427 ubuntu  mem    REG              252,0    42864 398327 /lib/x86_64-linux-gnu/security/pam_systemd.so
    sshd    1427 ubuntu  mem    REG              252,0    10376 393550 /lib/x86_64-linux-gnu/security/pam_umask.so
    sshd    1427 ubuntu  mem    REG              252,0    10288 393524 /lib/x86_64-linux-gnu/security/pam_keyinit.so
    sshd    1427 ubuntu  mem    REG              252,0    10344 393529 /lib/x86_64-linux-gnu/security/pam_loginuid.so
    sshd    1427 ubuntu  mem    REG              252,0    18752 393540 /lib/x86_64-linux-gnu/security/pam_selinux.so
    sshd    1427 ubuntu  mem    REG              252,0    10272 393534 /lib/x86_64-linux-gnu/security/pam_nologin.so
    sshd    1427 ubuntu  mem    REG              252,0    18952 393388 /lib/x86_64-linux-gnu/libcap.so.2.24
    sshd    1427 ubuntu  mem    REG              252,0    10376 393513 /lib/x86_64-linux-gnu/security/pam_cap.so
    sshd    1427 ubuntu  mem    REG              252,0     6112 393535 /lib/x86_64-linux-gnu/security/pam_permit.so
    sshd    1427 ubuntu  mem    REG              252,0     6024 393515 /lib/x86_64-linux-gnu/security/pam_deny.so
    sshd    1427 ubuntu  mem    REG              252,0    60288 393551 /lib/x86_64-linux-gnu/security/pam_unix.so
    sshd    1427 ubuntu  mem    REG              252,0    22952 393442 /lib/x86_64-linux-gnu/libnss_dns-2.19.so

    Example-3:

    To find Processes running on Specific Port:

    # lsof -i TCP:22

    output:

    # lsof -i TCP:22
    COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    sshd    1053   root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)
    sshd    1053   root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)
    sshd    1377   root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd    1427 ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd    1840   root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
    sshd    1930 ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    Example-4:

    To list Only IPv4 & IPv6 Open Files:

    # lsof -i 4

    # lsof -i 6

    output:

    # lsof -i 4
    COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    dhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpc
    dhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374
    sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)
    dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootps
    dnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domain
    dnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)
    sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
    sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    # lsof -i 6
    COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    dhclient  869 root   21u  IPv6  11701      0t0  UDP *:22830
    sshd     1053 root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)

    Example-5:

    To list Open Files of TCP Port ranges 1-1024:

    # lsof -i TCP:1-1024

    output:

    #  lsof -i TCP:1-1024
    COMMAND  PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    sshd    1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)
    sshd    1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)
    dnsmasq 1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)
    sshd    1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd    1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd    1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
    sshd    1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    Example-6:

    To Exclude User with ‘^’ Characte

    # lsof -i -u^root

    output:

    #  lsof -i -u^root
    COMMAND  PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    dnsmasq 1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootps
    dnsmasq 1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domain
    dnsmasq 1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)
    sshd    1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd    1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    Example-7:

    To find Out who’s Looking What Files and Commands:

    # lsof -i -u user1

    output:

    #  lsof -i -u user1
    COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    dhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpc
    dhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374
    dhclient  869            root   21u  IPv6  11701      0t0  UDP *:22830
    sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)
    sshd     1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)
    dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootps
    dnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domain
    dnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)
    sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
    sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    Example-8:

    To list all Network Connections:

    # lsof -i

    output:

    # lsof -i
    COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    dhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpc
    dhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374
    dhclient  869            root   21u  IPv6  11701      0t0  UDP *:22830
    sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)
    sshd     1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)
    dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootps
    dnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domain
    dnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)
    sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
    sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
    sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

    Example-9:

    To list processes which opened a specific file:

    # lsof /var/log/syslog

    output:

    #  lsof /var/log/syslog
    COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
    rsyslogd 687 syslog    1w   REG  252,0  1812935 11325 /var/log/syslog

    Example-10:

    To list opened files under a directory:

    # lsof +D /var/log/

    output:

    # lsof +D /var/log/
    COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
    init        1   root   14w   REG  252,0      733  11346 /var/log/upstart/systemd-logind.log
    rsyslogd  687 syslog    1w   REG  252,0  1813034  11325 /var/log/syslog
    rsyslogd  687 syslog    2w   REG  252,0  1694014  11335 /var/log/kern.log
    rsyslogd  687 syslog    4w   REG  252,0    39603  11870 /var/log/auth.log
    libvirtd 1171   root    4w   REG  252,0        0 135812 /var/log/libvirt/libvirtd.log

    Example-11:

    To list opened files based on process names:

    # lsof -c ssh -c init

    output:

    COMMAND  PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAME
    init       1   root  cwd    DIR              252,0     4096      2 /
    init       1   root  rtd    DIR              252,0     4096      2 /
    init       1   root  txt    REG              252,0   265848     54 /sbin/init
    init       1   root  mem    REG              252,0    47712 393444 /lib/x86_64-linux-gnu/libnss_files-2.19.so
    init       1   root  mem    REG              252,0    47760 393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.so
    init       1   root  mem    REG              252,0    97296 393438 /lib/x86_64-linux-gnu/libnsl-2.19.so
    init       1   root  mem    REG              252,0    39824 393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.so
    init       1   root  mem    REG              252,0    14664 393401 /lib/x86_64-linux-gnu/libdl-2.19.so
    init       1   root  mem    REG              252,0   252032 393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1
    init       1   root  mem    REG              252,0   141574 393475 /lib/x86_64-linux-gnu/libpthread-2.19.so
    init       1   root  mem    REG              252,0  1840928 393385 /lib/x86_64-linux-gnu/libc-2.19.so
    init       1   root  mem    REG              252,0    31792 393481 /lib/x86_64-linux-gnu/librt-2.19.so
    init       1   root  mem    REG              252,0    43464 393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0

    more....

     



    Advertisements